CVE-2019-14234

POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit CVE-2019-14234 Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField. Reference link:...

CVE-2026-112289

Koalixcrm versions through 1.14.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists because malicious task titles are rendered unescaped by the Task.link_to_task() function. Staff users can inject scripts that execute in the context of an administrator's browser...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-15307 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

Debian dla-4736 : python-django-doc - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4736 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected]...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-15307 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

ae-django-utils (0.3.1), django-admin-toolkit (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-15307 via django (4.0.0rc1)

django PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ae-django-utils 0.3.1 - django-admin-toolkit =0.1.5, =0.4.0a2, =0.1.0, =0.3.1, =0.1.0, =1.1.0, =1.0.0, =1.9.0 Source cves: CVE-2026-15307 Source...

alcali (>=2018.3.4, <=2019.2.4.post0), django-acsecure (0.1.3) +12 more potentially affected by CVE-2026-15830 via django (3.0.3)

django PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.4, =0.2.0, =0.1.5.1, =0.0.2, =0.1.1, =0.9.0, =0.1.0.1, =0.4.1, =0.5.1 Source cves: CVE-2026-15830 Source advisory:...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

Django 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by a cross-site scripting issue in django.contrib.admin.utils.display_for_field() that renders URLField values as clickable links without validating the URL. If an unsafe URL is already stored (e.g., via direct queryset writes, deserializ...

EUVD-2026-52750

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-53878 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-48588 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-53877 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

alcali (>=2018.3.4, <=2019.2.4.post0), django-acsecure (0.1.3) +12 more potentially affected by CVE-2026-53878 via django (3.0.3)

django PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.4, =0.2.0, =0.1.5.1, =0.0.2, =0.1.1, =0.9.0, =0.1.0.1, =0.4.1, =0.5.1 Source cves: CVE-2026-53878 Source advisory:...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2024-45231 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

ae-django-utils (0.3.1), django-admin-toolkit (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-48587 via django (4.0.0rc1)

django PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ae-django-utils 0.3.1 - django-admin-toolkit =0.1.5, =0.4.0a2, =0.1.0, =0.3.1, =0.1.0, =1.1.0, =1.0.0, =1.9.0 Source cves: CVE-2026-48587 Source...